CVE-2026-115252 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-115252 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-115252 is a critical unauthenticated remote code execution flaw in the Confection WordPress Cable plugin for WordPress, affecting versions 0.4.0 through 0.4.7. The plugin fails to check user permissions or require a nonce before saving settings, then writes one setting unmodified into a standalone PHP file that is served by the site. An attacker can abuse this to inject and execute arbitrary PHP code on the server without logging in.

This is the kind of issue that can fully compromise a small WordPress site, expose customer data, modify content, create admin users, or pivot into the hosting environment. Even though there is no known exploitation in the wild and it is not currently in CISA KEV, the severity is CVSS 10 and should be treated as an emergency.

Immediate Action

  • Disable or remove the plugin now if you do not have a fixed version available. If the plugin is business-critical, take the site offline briefly and restore from a clean backup after mitigation.
  • Upgrade immediately to the first patched release once confirmed by the vendor. If no patch exists yet, use a temporary rollback to a safe alternative plugin or disable the feature entirely. Vendor advisory / release notes
  • Block public access to the plugin’s generated PHP file or directory at the web server level if you can identify it, and rotate WordPress salts, admin passwords, and hosting credentials after remediation.
  • Review logs for suspicious POST requests to the plugin settings endpoint and for unexpected PHP file creation or modification times under the WordPress install.
  • Isolate the site if you see signs of compromise: place it behind maintenance mode, restrict inbound access to admin paths, and snapshot the server for forensics before cleaning.

Affected Versions

  • confection-wordpress-cable@0.4.0 through 0.4.7 are vulnerable.
  • confection-wordpress-cable@0.4.8+ safe version: TODO confirm from vendor release notes.
  • If your deployment bundles the plugin inside a WordPress theme, starter kit, or custom build, treat the bundled copy as vulnerable unless you verify the exact version.

Resolution Guide

WordPress / PHP

# If installed as a plugin, disable it immediately
wp plugin deactivate confection-wordpress-cable

# Check version
wp plugin list --field=name,version | grep -i confection

# Update once a fixed release is available
wp plugin update confection-wordpress-cable

# If no patch exists, remove it
wp plugin delete confection-wordpress-cable

Linux package management is usually not applicable for a WordPress plugin, but if your site is deployed from a system package or image, rebuild from a clean base and redeploy:

# Debian/Ubuntu-style rebuild workflow
sudo apt update
sudo apt install --only-upgrade wordpress php-fpm apache2 nginx

# RHEL/CentOS-style rebuild workflow
sudo yum update

Container deployments

# Rebuild the image after removing the vulnerable plugin from the build context
docker build --no-cache -t yoursite:fixed .

# Redeploy with a known-good tag
docker run -d --name yoursite yoursite:fixed

Hardening examples

# Block direct access to generated PHP files in the plugin directory (Apache example)
<Directory "/var/www/html/wp-content/plugins/confection-wordpress-cable">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx example
location ~* /wp-content/plugins/confection-wordpress-cable/.*\.php$ {
    deny all;
}

Minimal code fix pattern if you maintain a fork:

<?php
// Before saving settings
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( 'Unauthorized', 403 );
}

check_admin_referer( 'confection_save_settings' );

// Sanitize before writing to disk
$setting = sanitize_text_field( $_POST['setting'] ?? '' );

// Never write raw user input into executable PHP
file_put_contents( $path, "<?php\nreturn " . var_export( $setting, true ) . ";\n" );

Detection & Verification

Check installed version in WordPress admin, via WP-CLI, or by inspecting the plugin header:

grep -R "Version:" wp-content/plugins/confection-wordpress-cable/ -n
wp plugin list | grep -i confection

Look for risky behavior in the plugin codebase:

grep -R "file_put_contents\|fopen\|$_POST\|update_option\|admin_post" wp-content/plugins/confection-wordpress-cable/ -n
grep -R "check_admin_referer\|current_user_can" wp-content/plugins/confection-wordpress-cable/ -n

Check for signs of exploitation:

# Recent PHP file changes in the plugin directory
find wp-content/plugins/confection-wordpress-cable -name "*.php" -mtime -7 -ls

# Web server logs for suspicious requests
grep -R "wp-admin\|admin-ajax.php\|confection" /var/log/nginx /var/log/apache2 -n

Verify the fix by confirming the plugin version is patched and that unauthorized requests are rejected:

wp plugin list --field=name,version | grep -i confection
curl -i -X POST https://example.com/wp-admin/admin-ajax.php -d "action=TODO_ACTION"

The request should return 403 or a nonce failure, not a successful settings update. Also confirm the generated PHP file no longer accepts raw user input and that direct web access to the file is blocked.

Risk and Impact

This vulnerability can give an attacker full server-side code execution with no login required. On a small team’s WordPress site, that can mean total site takeover, data theft, spam injection, malware hosting, and credential harvesting from the same server or connected services.

The blast radius depends on how the site is hosted, but shared hosting, reused passwords, and broad filesystem permissions can turn a single plugin bug into a wider compromise. Treat any exposed instance as high risk until the plugin is removed or fully patched and verified.

Keep reading